Codebase debt
Nobody is accountable for the code a model wrote.
Every tool that wrote it was paid for lines added. Nobody in your stack is paid for lines deleted. The bill arrives quietly: features that take twice as long, deploys nobody wants to own, a security finding that was in the repo for months. We put a number on it, with a receipt for every line of the arithmetic.
Three rungs. A $495 scan that returns the number in two business days. A $1,500 audit that returns the whole ledger and a fixed price to pay it down, credited against the fix. A $1,500 rescue diagnosis for the build that already broke, credited against the repair.
Why the first number is a lie
The first number is always too big.
Every scanner overstates. Ours did: the first run on our own repository reported thirty-six findings, and eighteen of them were the scanner’s own bugs. A report that ships the inflated number closes deals and costs you a week chasing ghosts. The verify pass exists because the first draft of our own ledger lied to us.
Duplication is up. Refactoring collapsed.
Independent research on AI-assisted repositories finds copied code rising and refactoring falling, year over year. Every tool that wrote your code is paid for lines added. Nobody in your stack is paid for lines deleted.
Nobody is accountable for it.
A human who wrote a module can be asked why. A model that wrote it cannot, and the person who prompted it has moved on. The debt is real, it is quiet, and it arrives as slow features, scary deploys, and a security finding with your name on it.
The research, cited not asserted: an arXiv study of302,600 AI-authored commits across6,299 repositories found surviving AI-introduced debt growing from a few hundred issues to more than a hundred thousand inside a year. Your repository has its own numbers. What the industry's numbers mean for a business that ships: The Maintainability Gap Has a Dollar Sign.
The ledger, exactly as it renders
This is the real ledger from the run against our own open-source memory engine, dated 2026-07-30, after the scanner's own bugs were fixed. Every row names a file and a line, and the hours column is what the paydown is summed from. Yours arrives in the same shape.
| Sev | Probe | Location | Evidence | Hrs |
|---|---|---|---|---|
| medium | duplication | scripts/bootstrap.ts:796 | 15 duplicated lines, twin at scripts/bootstrap.ts:1015 | 0.50 |
| medium | duplication | scripts/bootstrap.ts:813 | 11 duplicated lines, twin at scripts/bootstrap.ts:1033 | 0.50 |
| medium | duplication | scripts/bootstrap.ts:847 | 31 duplicated lines, twin at scripts/bootstrap.ts:1069 | 0.50 |
| medium | duplication | scripts/bootstrap.ts:847 | 18 duplicated lines, twin at scripts/bootstrap.ts:1244 | 0.50 |
| medium | duplication | scripts/bootstrap.ts:903 | 22 duplicated lines, twin at scripts/bootstrap.ts:1125 | 0.50 |
| medium | duplication | scripts/bootstrap.ts:924 | 28 duplicated lines, twin at scripts/bootstrap.ts:1146 | 0.50 |
| medium | duplication | scripts/cli.ts:96 | 9 duplicated lines, twin at scripts/mcp-server.ts:272 | 0.50 |
| medium | duplication | scripts/mcp-server.ts:278 | 13 duplicated lines, twin at scripts/mcp-server.ts:318 | 0.50 |
| medium | duplication | src/contextual.ts:104 | 10 duplicated lines, twin at src/contextual.ts:181 | 0.50 |
| medium | churn | scripts/bootstrap.ts | deletion share of churn is 14.4% over 12 months (13,625 lines added, 2,288 deleted): code accumulates, little is retired | 0.00 |
Probes run: duplication, nine findings; churn, one. Every row comes from a deterministic tool (jscpd, semgrep, npm audit, gitleaks, git history), then a verify pass drops any finding whose file no longer exists. The paydown is the summed hours at a blended engineering rate, so the total is auditable, not asserted. Carrying drag is a proxy at eight percent of paydown per month, stated as an estimate. Secret values are never stored or shown, only their locations. The ledger is the diagnostic; the paydown is scoped and fixed-price separately, and the audit fee credits against it.
Three rungs
The Scan
$495 · two business daysFive to ten confirmed findings: duplicated logic, CWE-class security issues, dead code, architectural drift, each traceable to a file and line, ranked by severity, with a plain-language note on what each one costs to carry. The number before the audit.
Book a scan →The Audit
$1,500 · credited against the fixThe full ledger: every finding, the arithmetic behind the dollar figure, a ranked paydown plan, and a fixed price to pay it down. Fix tiers with the criticals merged as small pull requests, and a hardening pass that keeps the debt from re-accruing, are quoted in the ledger. Hire us for the fix and the fee credits in full.
Book the audit →The Rescue
$1,500 · credited against the repairFor the build that stalled, hallucinates, or was abandoned mid-flight. A multi-model review finds where it actually broke: the model, the tool wiring, the data, or the design. You get a written diagnosis, a ranked fix plan, and a real number for the repair, with the fee credited if we do it.
Book a diagnosis →Fixed scope, fixed price. The scan and the audit credit against the fix; the rescue credits against the repair. If we do the work and it is not merged and working, you do not pay the back half.
How the audit runs
- 01
Access
A read-only invite to the repository, or a zip. An NDA first if you want one. Nothing else to prepare; the probes read the code, not your team.
- 02
The deterministic run
Seven probes: duplication, security, dependencies, secrets, churn, tests, and complexity. The same tooling every time, so two scans a month apart are comparable and a trend means something.
- 03
The verify pass
Every finding is checked against the file it names. A finding whose file does not resolve is dropped, and the ledger prints how many were dropped. A drop count above zero is a note about the scanner, never a silent edit to the report.
- 04
The ledger
Findings ranked by severity and by what each costs you monthly, with the arithmetic shown. A fixed price for the paydown. On the scan, five to ten findings and the note; on the audit, all of them and the plan.
- 05
The fix, if you want it
Small pull requests, one finding at a time, each with test evidence and the metric before and after. You approve every merge. Nothing lands without your eyes on it, and the audit fee comes off the invoice.
We ran it on our own repository first
Before selling this to anyone, we pointed it at our own open-source memory engine. The first scan said $3,150 of debt and eight high-severity findings. Eighteen of the thirty-six findings turned out to be bugs in our own scanner: a duplication probe counting the same block from both ends, a security probe that had silently produced nothing and was read as a clean pass. We fixed the scanner, then paid the real debt down to$675, zero high severity. Duplication fell to 1.42% and70 tests stayed green through the refactor. The remediation commits are public on the repository, so the before and after can be checked by anyone. That is the standard the ledger holds: every number on it survived someone trying to prove it wrong.
Questions buyers ask
How is the dollar figure on the ledger calculated?
Every finding carries an estimate of the hours it takes to fix, weighted by severity and by how often the file is touched, against a blended engineering rate that the report states. The arithmetic ships in the ledger next to the findings, so you can check it or swap in your own rate.
We used Cursor, Copilot, or Claude Code heavily. Is this a judgment on that?
No. We use the same tools every day. Shipping fast was probably the right call. The audit is about what accrued while you shipped, and what it costs to carry, not about how you built.
How do I know the findings are real and not scanner noise?
Every finding passes a verify pass before it enters the ledger, and anything the pass cannot confirm is dropped and counted rather than hedged. We built that pass because the first scan of our own repository overstated the debt by half, and we published the whole story.
Scan, audit, or rescue: which one first?
The scan when you want the number in two business days. The audit when you want the full ledger and a fixed price for the paydown. The rescue when something is visibly broken and you need to know where. The scan and the audit fees credit against the audit and the fix; the rescue fee credits against the repair.
Can you do the fixes too?
Yes, and the audit is designed for it. Fixes land as small pull requests, each with test evidence and a before-and-after metric, merged only on your approval. The audit fee credits in full against the work.
Is my code safe with you?
An NDA on request before access. Read-only access, revoked at delivery. Nothing is retained after delivery except the ledger, and nothing is used as training data or shared with anyone.
Which languages and stacks?
TypeScript and JavaScript, Python, and most mainstream stacks. The duplication, dependency, and security probes are language-neutral where the tooling allows; ask if you are unsure and we will say which probes apply before you pay.
Two business days to a number you can act on.
The scan is $495. Read access and a primary language are all it needs. You get the findings, the file and line for each, and what each one costs to carry. If you want the whole ledger after that, the scan fee comes off the audit. After the fix, the watch keeps the number from climbing back.